Re: [Full-Disclosure] A worm...

From: Brett Hutley (brett_at_hutley.net)
Date: 06/27/03

  • Next message: Nick FitzGerald: "RE: [Full-Disclosure] A worm..." 
    To: "M. Osten" <lists@bleepyou.com>
Date: Fri, 27 Jun 2003 11:46:28 +1000

    At approximately 'Thu, Jun 26, 2003 at 07:37:12PM -0500' 'M. Osten' warbled:
    > On Thu, 2003-06-26 at 10:14, ATD wrote:
    > > Yes,
    > > And this was my point. Are the crafty "worm gods" creating worms that
    > > evade detection by using compression and other methods? If they are
    > > doing this, and if they are creating the "stealth worms" whats next. Zip
    > > files would be just one of hundreds of ways to hide worms. Maybe the
    > > virus scanning technology needs to be kicked up a notch or two.
    >
    > Do most virus scanners *not* scan compressed files? We scan all
    > incoming mail using Amavis (on linux) with the NAI engine which does
    > scanning of all the common compression schemes.

    Most virus scanners I believe DO scan compressed files.
    Worm gods use techniques like code morphing to make it harder to detect
    the worm rather than compression. Note that true worms propogate WITHOUT
    user intervention, so I think you are talking more about email viruses
    here. Worms that propogate without user intervention normally have
    defined attack vectors/exploits, and can be detected/screened by
    IDS/Firewall. 

    -- 
Brett Hutley [M.App.Fin., CISSP, SANS GCIH]
mailto:brett@hutley.net | "My other computer is ALSO a *nux box"
http://hutley.net/brett | PGPkey:http://hutley.net/brett/pupkey.txt
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Nick FitzGerald: "RE: [Full-Disclosure] A worm..."

    Relevant Pages

    • Re: bhp/l
      ... Hmmm - rotary diesel - could it be done? ... Doubt the compression could be made ... high enough - would solve the apex lube problem though I bet. ... Can of worms - what every fisherman wants. ...
      (uk.rec.cars.modifications)
    • RE: [Full-Disclosure] A worm...
      ... On Thu, 2003-06-26 at 10:14, ATD wrote: ... > evade detection by using compression and other methods? ... > virus scanning technology needs to be kicked up a notch or two. ... scanning of all the common compression schemes. ...
      (Full-Disclosure)